The essential CVE-2026-41940 authentication bypass vulnerability in cPanel, WHM, and WP Squared is being actively exploited within the wild and has been leveraged in makes an attempt since overdue February.
It’s unclear when exploitation began, however KnownHost, a web hosting supplier that makes use of cPanel, stated the day the vulnerability was once disclosed that “a hit exploits had been observed within the wild” sooner than a repair was to be had.
On the other hand, KnownHost CEO Daniel Pearson mentioned that the corporate has “observed execution makes an attempt as early as 2/23/2026.”
Newly revealed technical main points, which can be utilized to broaden an exploit, disclose that the problem is a “Carriage Go back Line Feed (CRLF) injection within the login and consultation loading processes of cPanel & WHM.”
cPanel launched a repair on April 28, following power from web hosting suppliers. To give protection to shoppers, Namecheap quickly blocked connections to cPanel and WHM ports 2083 and 2087 till patches was to be had.
A document from offensive safety corporate watchTowr explains that the flaw is led to by way of unsuitable consultation dealing with in cPanel & WHM, the place user-controlled enter from the Authorization header is written into server-side consultation information sooner than authentication and with out correct sanitization.
watchTowr researchers additionally revealed an in depth research on how the trojan horse will also be caused to log into the machine with out validating the supplied password, which can be utilized to broaden a operating exploit.
In keeping with Rapid7, Shodan web scans display that there are roughly 1.5 million cPanel cases uncovered on-line. On the other hand, there’s no knowledge on what number of are prone to CVE-2026-41940.
“A hit exploitation of CVE-2026-41940 grants an attacker keep an eye on over the cPanel host machine, its configurations and databases, and internet sites it manages,” Rapid7 warns.
cPanel has up to date its safety advisory, noting that the vulnerability additionally affects WP Squared, a complete control panel for WordPress web hosting constructed on cPanel. Moreover, in contrast to to start with mentioned, handiest cPanel variations after 11.40 are suffering from the safety factor.
The seller strongly recommends that every one shoppers restart the ‘cpsrvd’ carrier after putting in the newest releases of the tool:
Affected releases and glued variations are:
- cPanel/WHM 11.110.0 → mounted in 11.110.0.97
- cPanel/WHM 11.118.0 → mounted in 11.118.0.63
- cPanel/WHM 11.126.0 → mounted in 11.126.0.54
- cPanel/WHM 11.132.0 → mounted in 11.132.0.29
- cPanel/WHM 11.134.0 → mounted in 11.134.0.20
- cPanel/WHM 11.136.0 → mounted in 11.136.0.5
- WP Squared 11.136.1 → mounted in 11.136.1.7
If patching isn’t instantly imaginable, shoppers will have to no less than block exterior get admission to to ports 2083, 2087, 2095, and 2096, or prevent the cpsrvd and cpdavd cPanel inside core products and services.
The seller additionally supplied a detection script to test for compromise. If signs are discovered, it’s beneficial to purge classes, reset all credentials, audit logs, and examine endurance mechanisms.
watchTowr has additionally revealed a Detection Artifact Generator script that can be utilized to ensure if cPanel and WHM cases are prone to CVE-2026-41940.
AI chained 4 zero-days into one exploit that bypassed each renderer and OS sandboxes. A wave of latest exploits is coming.
On the Self sustaining Validation Summit (Might 12 & 14), see how self reliant, context-rich validation reveals what is exploitable, proves controls cling, and closes the remediation loop.
Declare Your Spot
